| Previous | Next |
| TPM_E_MA_TICKET_SIGNATURE | TPM_E_MA_SOURCE |
TPM_E_MA_DESTINATION
The state machine behind the code
TPM_E_MA_DESTINATION means the certified-migration destination has not been authenticated as required by the TPM 1.2 workflow.
Evidence table
| Question | Evidence |
|---|---|
| What exact state was rejected? | the certified-migration destination has not been authenticated as required by the TPM 1.2 workflow |
| Which layer owns the result? | The certified-migration, key-policy or EK administrative checkpoint. |
| What must be correlated? | destination public key and digest, migration ticket, authority identity, destination nonce, command sequence, and proof verification |
| Controlled comparison | validate the destination proof independently and test a newly authorized destination key |
A useful trace links three code-specific timelines: the application call, the local TBS/provider or firmware event, and the raw command/response exchange. The timestamps should describe one attempt; combining data from separate retries is particularly misleading for authorization sessions, context counters, DAA stages and lockout state.
Reproduction plan
The one-variable check is to validate the destination proof independently and test a newly authorized destination key. Record the before/after state that the command is allowed to change. If the operation can have side effects, use a disposable key, session, counter or NV index rather than production material.
- Capture this result and
0x8028005Dat the first code-specific return boundary. - Decode the relevant state: key attributes, authority tickets, source and destination identities, signatures and provisioning state.
- Run the controlled comparison once and preserve both binary transcripts.
- Verify the expected output or state transition instead of relying on absence of a UI message.
Contrast with neighboring results
| Comparison code | Built-in distinction |
|---|---|
TPM_E_MA_SOURCE | Migration source incorrect. |
TPM_E_MA_TICKET_SIGNATURE | Migration authority signature validation failure. |
TPM_E_MA_AUTHORITY | Incorrect migration authority. |
It specifically answers whether the certified-migration destination has not been authenticated as required by the TPM 1.2 workflow. In contrast, TPM_E_MA_SOURCE identifies a problem with the source side of the migration relationship.
Confirming remediation
To remediate it, complete destination authentication through the migration authority before creating or applying the migration blob. Do not edit a signed ticket, migration blob or opaque private-key structure. Binary normalization, JSON conversion or base64 line handling can invalidate the authority and integrity relationships.
Authoritative references
Looking for a different code? Search another status or error code.